Riskcovery

CVE-2026-98518

drm/nouveau/dmem: pin VRAM for the whole registered range

State
Published
Severity
7.0 High
Published
Oct 18, 2026
Updated
Oct 24, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/dmem: pin VRAM for the whole registered range

Commit c32287471077 ("gpu/drm/nouveau: enable THP support for GPU memory migration") grew the device-private region that nouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to DMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that region at DMEM_CHUNK_SIZE.

nouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset within the registered region, so every page past the first chunk resolves to VRAM outside the buffer object.

Size the buffer object to the region it backs.

Scores

CVSSScoreVectorSource
3.17.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c3228747107705d47c7e9a03598a434a0380cb73 to before 06c69c64686a31783c8bec6495dc22822d38c4ceAffected
  • c3228747107705d47c7e9a03598a434a0380cb73 to before 64ca4cdd1031206424e6455f0ae4fb0560d8f46aAffected
LinuxLinux
  • 6.19Affected
  • before 6.19Not affected
  • 7.2.9 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.